Friday, July 17, 2009

Book Review: Beautiful Security

Like O’Reilly’s Beautiful Teams, this book’s a series of essays by industry experts, this time focused on security. The various authors do a great job of covering topics from social engineering to forcing firms to focus on security. The chapters are all well-written, although a few do better jobs of keeping the material interesting and flowing.

You’ll find plenty of security-related history in the book. Phil Zimmerman’s chapter on PGP’s Web Of Trust is one example. Pieter Zatko’s discussion of his work on the LH0phtCrack is another. Both stories help expose mindsets which, sadly, haven’t changed a whole lot.

Security, as with testing or overall quality, is at its most fundamental roots a culture issue. Not every story focuses on this aspect, but pointing out bad culture is a common theme through many of the chapters. Zatko’s discussion of “Learned Helplessness,” John McManus’s Security by Design, and Jim Routh’s Forcing Firms to Focus are all great reads on this line. Many of the stories correctly emphasize that security isn’t just about someone hacking code – it’s a much broader issue.

As with any good security book, there’s plenty of well-done content which will likely scare you in to re-thinking how you and your company approach security. Beautiful Security can help you identify practices, problems, and mindsets which leave you, your company, or your clients at risk.

Overall it’s a very useful, highly readable book on a critical subject.

No comments:

About Me

I'm the owner/principal of Guidepost Systems. I help lots of great folks figure out what works and what doesn't in the world of delivering quality software -- something I'm very passionate about. I'm also a Father trying to remain sane while trying to build great software, herd my kids around, fix school lunches and handle the yardwork. (And roast great coffee!)